Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 16:20
Behavioral task
behavioral1
Sample
f9135f3216c2ee3b0afedf06c74c6230N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f9135f3216c2ee3b0afedf06c74c6230N.exe
Resource
win10v2004-20240802-en
General
-
Target
f9135f3216c2ee3b0afedf06c74c6230N.exe
-
Size
24KB
-
MD5
f9135f3216c2ee3b0afedf06c74c6230
-
SHA1
97de6bd99cbc25b1c9c69b5578879426b1a8c9e4
-
SHA256
16497ebf6c1939d90f685c2cf7cff2b2b9e2a77ae19822d112a0a166e98c7d60
-
SHA512
f373a996cdc64dc6463438637c3833cd3839eebb5571c21c89b140961ca886b6a02e976d5a6923a916d6a7775cb62cf13f5c7ee107f5ea1ff7f6c815e851767b
-
SSDEEP
384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9TNYmAE:kBT37CPKKdJJ1EXBwzEXBwdcMcI9T+MD
Malware Config
Signatures
-
Renames multiple (3447) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2300-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000d00000001226a-2.dat upx behavioral1/files/0x00020000000104f5-6.dat upx behavioral1/memory/2300-75-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\local_policy.jar.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\El_Salvador.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Microsoft Games\More Games\MoreGames.dll.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\favicon.ico.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Windows Mail\it-IT\WinMail.exe.mui.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ChkrRes.dll.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\VideoLAN\VLC\libvlccore.dll.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Lord_Howe.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_ja.jar.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Baku.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jre7\bin\server\classes.jsa.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Windows Journal\fr-FR\jnwmon.dll.mui.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Windows Mail\oeimport.dll.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Design.resources.dll.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Windows Mail\wabmig.exe.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp f9135f3216c2ee3b0afedf06c74c6230N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f9135f3216c2ee3b0afedf06c74c6230N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD51d7bc55e0d0052d9f09611def695ddcc
SHA1d6ebb58338fc7ae4b9cd873f81475de6f82b0f48
SHA256b4d849703c7d14e3b164d3a1da2af9643c54ba2481628ceca6480036cc61396c
SHA512e68b3f63f70e26b1ebac269e435d9ef99903a7fefd6801273ba3e19a93991fe786f4376a65594f879360044e88e2658439483aef6698dd1b6498fbe149e7af76
-
Filesize
33KB
MD5bf488df21c7f7e66be9c3700b0de55b4
SHA19d00c0398c7c2c24d3dc95de62e0b799c72a5137
SHA256932c9b66109a18d1809a1f3f83ea512a04c04d9df4bb9c93b4b209f3d42f91e9
SHA5127b8b5e1bd197e677973e42163a7c96d9aa185b46e549fea6ece3cf1d0462f2f81a1c770457a55216dbedcbed837ad5123e18af1931b6e9b88f60b1f8a6337054